Mon PC rame enormement, que faire?

Bonjour,

Et voilà le rapport:


############################## | UsbFix V6.037 |
User : Maison (Administrateurs) # PC
Update on 27/09/2009 by Chiquitine29, C_XX & Chimay8
Start at: 13:18:35 | 09/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18813
Windows Firewall Status : Enabled
C:\ -> Disque fixe local # 143,98 Go (88,32 Go free) [HP] # NTFS
D:\ -> Disque fixe local # 5,06 Go (601,21 Mo free) [Recovery] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 981,01 Mo (192 Mo free) # FAT32
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque CD-ROM # 4,09 Mo (0 Mo free) [U3 System] # CDFS
L:\ -> Disque amovible # 1,86 Go (575,19 Mo free) [My U3 Drive] # FAT
############################## | Processus actifs |
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\runonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
################## | Fichiers # Dossiers infectieux |
Supprimé ! C:\autorun.inf
Supprimé ! D:\autorun.inf
Non supprimé ! K:\autorun.inf
Supprimé ! L:\autorun.inf
################## | Registre # Clés Run infectieuses |

################## | Registre # Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\{4570a947-1d76-11dc-b48e-001a9210e22a}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[18/09/2006 23:43|--a------|24] C:\autoexec.bat
[11/04/2009 08:36|-rahs----|333257] C:\bootmgr
[11/12/2006 21:10|-ra-s----|8192] C:\BOOTSECT.BAK
[18/09/2006 23:43|--a------|10] C:\config.sys
[03/12/2008 13:34|--a------|0] C:\DFR83B.tmp
[21/09/2009 19:53|--a------|3814] C:\FindyKill.txt
[07/10/2007 22:37|-rahs----|0] C:\IO.SYS
[07/10/2007 22:37|-rahs----|0] C:\MSDOS.SYS
[10/04/2009 23:16|--a------|304160] C:\PA207.DAT
[?|?|?] C:\pagefile.sys
[09/04/2008 11:52|--a------|477] C:\RHDSetup.log
[09/10/2009 13:23|--a------|3519] C:\UsbFix.txt
[06/04/2009 15:43|--a------|0] C:\ZipCodec.txt
[04/10/2006 01:02|--ahs----|438328] D:\boo.mgr
[02/11/2006 02:53|--ahs----|438840] D:\bootmgr
[01/10/2007 20:05|--ahs----|22] D:\HPCD.sys
[01/10/2007 19:59|--ahs----|187] D:\MASTER.LOG
[28/06/2007 11:52|-ra------|528] D:\MediaID.bin
[09/03/2007 18:07|--ah-----|487] D:\pcdr.ini
[10/09/2002 14:58|--ahs----|181616] D:\Protect.ed
[01/10/2007 19:25|-r-hs----|26] D:\RCBoot.sys
[11/12/2006 22:24|--ahs----|44] D:\RESTORE.INI
[18/10/2006 12:09|--ahs----|34] D:\SystemRecovery.txt
[17/07/2007 13:26|--a------|3061033] F:\La Liste.mp3
[06/09/2007 11:02|--a------|2229812] F:\luis amstrong - louis armstrong - what a wonderfull world.mp3
[26/07/2007 14:44|--a------|3468148] F:\Michel Berger - Quelques mots d'amour (1980).mp3
[06/09/2007 11:48|--a------|3152794] F:\Mon amour de St-Jean.mp3
[05/12/2006 10:44|--a------|4334355] F:\06 Ciao Bella.mp3
[28/10/2005 11:30|--a------|6832275] F:\09 retomber amoureux.mp3
[28/10/2005 11:30|--a------|7887715] F:\04 je viens du sud.mp3
[28/10/2005 11:22|--a------|4869190] F:\08 dis-moi que tu m'aimes.mp3
[08/05/2009 22:23|--a------|5431318] F:\01 City of New Orleans.mp3
[08/05/2009 22:27|--a------|3269173] F:\02 Ring of Fire.mp3
[08/05/2009 22:27|--a------|3419710] F:\03 Let It Be Me.mp3
[08/05/2009 22:27|--a------|3494353] F:\04 Lay Lady Lay.mp3
[08/05/2009 22:27|--a------|2717065] F:\05 Crazy.mp3
[08/05/2009 22:27|--a------|3212878] F:\06 Suspicious Minds.mp3
[08/05/2009 22:27|--a------|3201202] F:\07 You Never Can Tell.mp3
[08/05/2009 22:27|--a------|3688675] F:\08 And I Love You So.mp3
[08/05/2009 22:27|--a------|3981826] F:\09 Always on My Mind.mp3
[08/05/2009 22:27|--a------|4895890] F:\10 Ode to Billy Joe.mp3
[08/05/2009 22:27|--a------|2990200] F:\11 I Will Always Love You.mp3
[08/05/2009 22:27|--a------|3336727] F:\12 City of New Orleans-Salut Les Amoureux [-].mp3
[08/05/2009 22:27|--a------|3418459] F:\13 Let It Be Me-Je T'Appartiens [-].mp3
[08/05/2009 22:27|--a------|4020190] F:\14 Ode to Billy Joe-La Marie-Jeanne [-].mp3
[08/05/2009 22:27|--a------|3648643] F:\01 Reviens-Moi.mp3
[08/05/2009 22:27|--a------|3976405] F:\02 Ame Gone.mp3
[08/05/2009 22:27|--a------|3865483] F:\03 H“tel d'Angleterre.mp3
[08/05/2009 22:27|--a------|3106126] F:\04 Fallait-Il Que l'On S'Aime!.mp3
[08/05/2009 22:27|--a------|3542725] F:\05 Tout Recommencer.mp3
[08/05/2009 22:27|--a------|4000174] F:\06 J'M 'En Veux.mp3
[08/05/2009 22:27|--a------|3362164] F:\07 Ma Vie Sans Toi.mp3
[08/05/2009 22:27|--a------|3632380] F:\08 On Aura Tout le Temps.mp3
[08/05/2009 22:27|--a------|3576502] F:\09 Chanter le Blues.mp3
[08/05/2009 22:27|--a------|3744136] F:\10 Et Mˆme, Si C'est Bateau.mp3
[08/05/2009 22:27|--a------|3849220] F:\11 Aimez-Vous.mp3
[08/05/2009 22:27|--a------|1664974] F:\12 Je Prendds, Je Laisse.mp3
[13/02/2006 19:09|-r-------|921600] K:\LaunchU3.exe
[25/04/2006 16:37|-r-------|2992834] K:\Launchpad.zip
[13/02/2006 19:08|-r-------|145] K:\autorun.inf
[13/02/2006 18:09|-ra------|921600] L:\LaunchU3.exe
[25/09/2008 12:48|--a------|40310272] L:\Carte invitation.pub
[24/10/2008 19:49|--a------|453575] L:\S5000104.JPG
[24/10/2008 19:51|--a------|144840] L:\S5000131.JPG
[12/07/2008 03:58|--a------|2237104] L:\11.07.08 (2).JPG
[01/06/2008 15:26|--a------|2402931] L:\01.06.2008 (3).JPG
[24/10/2008 19:53|--a------|202191] L:\CINDY - 07.06.JPG
[09/06/2007 15:01|--a------|1263451] L:\Cousinade - 08.05.06.jpg
[24/10/2008 20:09|--a------|523985] L:\Cousinade - 08.05.06.jpg
[24/10/2008 20:10|--a------|342402] L:\CATH - 07.06.JPG
[24/10/2008 20:13|--a------|163872] L:\noˆl 2007 (3).JPG
[17/05/2008 15:41|--a------|2607263] L:\S5000755.JPG
[18/05/2008 09:36|--a------|490242] L:\S5000777.JPG
[18/05/2008 17:48|--a------|2522643] L:\S5000751.JPG
[18/05/2008 17:48|--a------|2628800] L:\S5000754.JPG
[11/04/2007 00:26|--a------|2365096] L:\S5000082.JPG
[11/04/2007 00:36|--a------|2388412] L:\S5000144.JPG
[10/04/2007 15:38|--a------|2333887] L:\S5000208.JPG
[11/04/2007 15:59|--a------|852817] L:\S5000210.JPG
[09/06/2007 11:58|--a------|1870883] L:\S5000250.JPG
[10/08/2006 10:58|--a------|1223941] L:\S5000219.JPG
[12/03/2007 01:08|--a------|1136067] L:\S5000271.JPG
[11/08/2006 11:47|--a------|1208139] L:\S5000288.JPG
[12/03/2007 01:09|--a------|1300694] L:\S5000299.JPG
[04/08/2006 13:00|--a------|3156793] L:\P8040062.JPG
[08/08/2006 11:03|--a------|1317992] L:\S5000181.JPG
[12/03/2007 01:08|--a------|1315396] L:\S5000270.JPG
[15/08/2006 13:52|--a------|1220575] L:\S5000331.JPG
[29/07/2008 13:11|--a------|2066818] L:\S5000969.JPG
[01/08/2008 13:42|--a------|2373692] L:\S5001070.JPG
[01/08/2008 14:33|--a------|1595133] L:\S5001084.JPG
[10/08/2008 22:15|--a------|1820826] L:\S5001085.JPG
[30/10/2008 00:19|--a------|62319616] L:\MB.ppt
[30/10/2008 21:45|--a------|1319581] L:\Num‚riser001001.JPG
[02/11/2008 18:04|--a------|3550215] L:\S5000778.zip
[02/11/2008 18:04|--a------|358553] L:\ScannedImage-42.jpg
[02/11/2008 18:04|--a------|804227] L:\ScannedImage-43.zip
[06/11/2008 00:13|--a------|412678144] L:\Papa.ppt
[13/04/2009 11:08|--a------|297500] L:\S5002494.JPG
[12/04/2009 20:46|--a------|774104] L:\DSCF0505.JPG
[12/04/2009 20:03|--a------|484878] L:\DSCF0504.JPG
[11/04/2009 17:32|--a------|467849] L:\DSCF0445.JPG
[11/04/2009 17:38|--a------|801702] L:\DSCF0449.JPG
[12/04/2009 11:05|--a------|2484960] L:\DSCF0419.JPG
[11/04/2009 17:30|--a------|489723] L:\DSCF0443.JPG
################## | Vaccination |
# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.
# F:\autorun.inf -> Folder created by UsbFix.
# L:\autorun.inf -> Folder created by UsbFix.
################## | Upload |
Veuillez envoyer le fichier : C:\Users\Maison\Desktop\UsbFix_Upload_Me_PC.zip : https://www.androidworld.fr/
Merci pour votre contribution .

Bonjour,

J'ai lu dans une autre discution que je pouvais lancer cette analyse en mode sans echec, est-ce utile?

Et est ce que je branche mes clé USB, disque dur ...etc?

Bonjour,

alors voilà le rapport de Malwarebytes que tu m'a demandé, l'analyse a été assez rapide en fait.


Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2796
Windows 6.0.6002 Service Pack 2 (Safe Mode)

12/10/2009 15:20:53
mbam-log-2009-10-12 (15-20-53).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|)
Eléments examinés: 227915
Temps écoulé: 37 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hpsysdrv (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\hp\support\hpsysdrv.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 10/15/2009 at 09:20 PM
Application Version : 4.29.1004
Core Rules Database Version : 4167
Trace Rules Database Version: 2089
Scan type : Complete Scan
Total Scan Time : 00:32:49
Memory items scanned : 288
Memory threats detected : 0
Registry items scanned : 7644
Registry threats detected : 0
File items scanned : 31048
File threats detected : 65
Adware.Tracking Cookie
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@lascad.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@xiti[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@serving-sys[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@bouyguestelecom.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@boursoramabanque.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@bs.serving-sys[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@cetelem.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@ads.pointroll[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@atdmt[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@smartadserver[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@msnportal.112.2o7[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@weborama[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@samsung.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\maison@cnam.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@adserver.aol[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@interflora2.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@www.smartadserver[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@smartadserver[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@lagarderefrance.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@adserver.aol[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@gemeycolorsensational.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@zanox[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@tacoda[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@boursoramabanque.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@lagarderefrance.solution.weborama[3].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@bnpparibasnet.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@canoe.112.2o7[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@cnam.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@cetelem.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@virginmobile.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@adfarm1.adition[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@fortuneopub.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@cmpmedica.112.2o7[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@nestle.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@garnier2009.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@www3.smartadserver[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@tracking.publicidees[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@groupecdn.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@ww57.smartadserver[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@xiti[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@aimfar.solution.weborama[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@aimfar.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@fr.at.atwola[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@track.webtrekk[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@xiti[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@bs.serving-sys[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@bouyguestelecom.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@atwola[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@atwola[3].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@advertstream[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@serving-sys[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@content.yieldmanager[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@content.yieldmanager[3].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@msnportal.112.2o7[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@at.atwola[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@at.atwola[3].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@www.googleadservices[3].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@www.googleadservices[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@www.googleadservices[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@samsung.solution.weborama[2].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@avgtechnologies.112.2o7[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@sfr.122.2o7[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@gemeypuremineralpoudres.solution.weborama[1].txt
C:\Users\Maison\AppData\Roaming\Microsoft\Windows\Cookies\Low\maison@fr.at.atwola[1].txt

BitDefender Online Scanner



Rapport d'analyse généré à: Sun, Oct 18, 2009 - 14:43:30





Voie d'analyse: C:\;D:\;E:\;G:\;H:\;I:\;J:\;







Statistiques

Temps
01:26:16

Fichiers
97517

Directoires
21680

Secteurs de boot
0

Archives
1728

Paquets programmes
8450




Résultats

Virus identifiés
1

Fichiers infectés
1

Fichiers suspects
0

Avertissements
0

Désinfectés
0

Fichiers effacés
1




Info sur les moteurs

Définition virus
4369649

Version des moteurs
AVCORE v2.1 Windows/i386 11.0.0.26 (Aug 27 2009)

Analyse des plugins
17

Archive des plugins
44

Unpack des plugins
8

E-mail plugins
6

Système plugins
4




Paramètres d'analyse

Première action
Désinfecté

Seconde Action
Supprimé

Heuristique
Oui

Acceptez les avertissements
Oui

Extensions analysées
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions


Analyse d'emails
Oui

Analyse des Archives
Oui

Analyser paquets programmes
Oui

Analyse des fichiers
Oui

Analyse de boot
Oui




Fichier analysé
Statut

C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\UsbFix.exe
Infecté par: Trojan.Generic.IS.614958

C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\UsbFix.exe
Supprimé

List'em by g3n-h@ckm@n 1.0.4.2

updated on 09.10.2009 ::::: 14.30

Windows_NT

Microsoft Windows [version 6.0.6002]


18/10/2009 17:05:05,31


Nom de l'h“te: PC
Nom du systŠme d'exploitation: Microsoft© Windows VistaT dition Familiale Premium
Version du systŠme: 6.0.6002 Service Pack 2 version 6002
Fabricant du systŠme d'exploitation: Microsoft Corporation
Configuration du systŠme d'exploitation: Station de travail autonome
Type de version du systŠme d'exploitation: Multiprocessor Free
Propri‚taire enregistr‚: Maison
Organisation enregistr‚e: Hewlett-Packard Company
Identificateur de produit: 89578-OEM-7332157-00061
Date d'installation originale: 20/12/2006, 17:54:53
Heure de d‚marrage du systŠme: 18/10/2009, 15:02:30
Fabricant du systŠme: HP-Pavilion
ModŠle du systŠme: RR477AA-ABF t3712.fr
Type du systŠme: X86-based PC
Processeur(s): 1 processeur(s) install‚(s).
[01]ÿ: x64 Family 15 Model 6 Stepping 2 GenuineIntel ~3000 MHz
Version du BIOS: Phoenix Technologies, LTD 5.06, 24/11/2006
R‚pertoire Windows: C:\Windows
R‚pertoire systŠme: C:\Windows\system32
P‚riph‚rique d'amor‡age: \Device\HarddiskVolume1
Option r‚gionale du systŠme: fr;Fran‡ais (France)
ParamŠtres r‚gionaux d'entr‚e: fr;Fran‡ais (France)
Fuseau horaire: (GMT+01:00) Bruxelles, Copenhague, Madrid, Paris
M‚moire physique totale: 1ÿ014 Mo
M‚moire physique disponible: 346 Mo
Fichier d'‚changeÿ: taille maximale: 2ÿ292 Mo
Fichier d'‚changeÿ: disponible: 1ÿ270 Mo
Fichier d'‚changeÿ: en cours d'utilisation: 1ÿ022 Mo
Emplacements des fichiers d'‚change: C:\pagefile.sys
Domaine: WORKGROUP
Serveur d'ouverture de session: \\PC
Correctif(s): 197 Corrections install‚es.
[01]: {3E439F9C-CCF8-4AB8-8AE1-063F2042A78B}
[02]: {14B11C98-291A-44B1-8AEA-DCCE20B5E13A}
[03]: {17A63756-C0F5-4393-A4E9-FF05F5498C86}
[04]: {1B3307FB-B5AD-4877-AA3C-DB0DABF5902E}
[05]: {1E045AEC-D6EA-4D1D-A1E6-106EFEB272C1}
[06]: {3055259C-80B5-4840-B990-F8663DD086A4}
[07]: {30A8A61F-1003-4E35-9B9B-F30FBA4B5495}
[08]: {8AC32162-38D5-40B9-A90B-E985CA7CB7B6}
[09]: {9F2DFB2F-DDA1-4034-84FA-D008BDD93972}
[10]: {B90C7CE3-2A3E-4E5B-A1B0-E5B5BCF6CA8E}
[11]: {C6F1E87D-F3E1-4874-97EC-F87DAB6D6878}
[12]: {CA93C194-87EF-4A2C-B2DE-99F3AF4CD36A}
[13]: {D57D126D-B706-4ACB-A096-A12ED7A26AA5}
[14]: {D80D6ACB-FAFA-4DAA-9CE4-3AF04013C693}
[15]: {DC1D9193-DDFC-4108-9163-708FB7D6BDA7}
[16]: {E24359EB-38A9-41FC-B7AA-FFD26DD0DA47}
[17]: {F6701F19-C0ED-4BCF-8451-D51419A2E0CB}
[18]: {FD6BE019-4DB7-40D9-B377-F27BC2F8EA40}
[19]: {22A15D5A-3165-4970-86BE-A5D5661E77E1}
[20]: {8B2F38F1-6D3C-4D87-AD2F-954AF6942800}
[21]: {27053779-8298-4D43-B94E-6658D2495DDA} - Microsoft Works 8.0 installation.
[22]: KB937286
[23]: KB944036
[24]: 944036
[25]: KB925902
[26]: KB929399
[27]: KB929685
[28]: KB929735
[29]: KB930178
[30]: KB930857
[31]: KB931099
[32]: KB931573
[33]: KB932471
[34]: KB932818
[35]: KB933579
[36]: KB933729
[37]: KB935652
[38]: KB936021
[39]: KB936357
[40]: KB936782
[41]: KB936825
[42]: KB937077
[43]: KB938127
[44]: KB939159
[45]: KB941202
[46]: KB941229
[47]: KB941568
[48]: KB941569
[49]: KB941600
[50]: KB941644
[51]: KB943055
[52]: KB943078
[53]: KB945553
[54]: KB946026
[55]: KB946456
[56]: KB947172
[57]: KB905866
[58]: KB928089
[59]: KB929123
[60]: KB929916
[61]: KB931213
[62]: KB931768
[63]: KB931836
[64]: KB932246
[65]: KB933360
[66]: KB933566
[67]: KB933928
[68]: KB935280
[69]: KB935807
[70]: KB936824
[71]: KB937143
[72]: KB937287
[73]: KB938123
[74]: KB938194
[75]: KB938371
[76]: KB938464
[77]: KB938979
[78]: KB939653
[79]: KB941649
[80]: KB941651
[81]: KB941693
[82]: KB942615
[83]: KB942624
[84]: KB942763
[85]: KB943302
[86]: KB943411
[87]: KB943899
[88]: KB944533
[89]: KB946041
[90]: KB947562
[91]: KB947864
[92]: KB948590
[93]: KB948609
[94]: KB948610
[95]: KB948881
[96]: KB949246
[97]: KB949247
[98]: KB950124
[99]: KB950125
[100]: KB950126
[101]: KB950582
[102]: KB950759
[103]: KB950760
[104]: KB950762
[105]: KB950974
[106]: KB951066
[107]: KB951072
[108]: KB951376
[109]: KB951618
[110]: KB951698
[111]: KB951978
[112]: KB952004
[113]: KB952069
[114]: KB952287
[115]: KB952709
[116]: KB953155
[117]: KB953733
[118]: KB953838
[119]: KB953839
[120]: KB954154
[121]: KB954155
[122]: KB954211
[123]: KB954366
[124]: KB954459
[125]: KB954708
[126]: KB955020
[127]: KB955069
[128]: KB955302
[129]: KB955430
[130]: KB955519
[131]: KB955839
[132]: KB956390
[133]: KB956391
[134]: KB956572
[135]: KB956744
[136]: KB956802
[137]: KB956841
[138]: KB957095
[139]: KB957097
[140]: KB957200
[141]: KB957321
[142]: KB957388
[143]: KB958215
[144]: KB958481
[145]: KB958483
[146]: KB958623
[147]: KB958624
[148]: KB958644
[149]: KB958687
[150]: KB958690
[151]: KB959108
[152]: KB959130
[153]: KB959426
[154]: KB959772
[155]: KB960225
[156]: KB960544
[157]: KB960714
[158]: KB960715
[159]: KB960803
[160]: KB961260
[161]: KB961371
[162]: KB961501
[163]: KB963027
[164]: KB967632
[165]: KB967723
[166]: KB968389
[167]: KB968537
[168]: KB968816
[169]: KB969897
[170]: KB969897
[171]: KB969898
[172]: KB970238
[173]: KB970653
[174]: KB970710
[175]: KB971180
[176]: KB971486
[177]: KB971557
[178]: KB971657
[179]: KB971930
[180]: KB971961
[181]: KB972036
[182]: KB972260
[183]: KB972636
[184]: KB973346
[185]: KB973507
[186]: KB973525
[187]: KB973540
[188]: KB973768
[189]: KB973874
[190]: KB974306
[191]: KB974455
[192]: KB974470
[193]: KB974571
[194]: KB975467
[195]: KB975517
[196]: KB948465
[197]: 940157
Carte(s) r‚seau: 1 carte(s) r‚seau install‚e(s).
[01]: Connexion r‚seau Intel(R) PRO/100
Nom de la connexionÿ: Connexion au r‚seau local
DHCP activ‚ÿ: Oui
Serveur DHCPÿ: 192.168.1.1
Adresse(s) IP
[01]: 192.168.1.20
[02]: fe80::59d6:2c8c:f23:ca19

Nom de l'image PID Nom de la sessio Num‚ro de s Utilisation
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 24 Ko
System 4 Services 0 15ÿ832 Ko
smss.exe 460 Services 0 104 Ko
csrss.exe 528 Services 0 1ÿ952 Ko
wininit.exe 572 Services 0 116 Ko
csrss.exe 580 Console 1 11ÿ944 Ko
winlogon.exe 640 Console 1 932 Ko
services.exe 664 Services 0 2ÿ068 Ko
lsass.exe 684 Services 0 2ÿ108 Ko
lsm.exe 692 Services 0 1ÿ056 Ko
svchost.exe 880 Services 0 3ÿ360 Ko
svchost.exe 944 Services 0 3ÿ396 Ko
svchost.exe 988 Services 0 24ÿ440 Ko
svchost.exe 1084 Services 0 4ÿ568 Ko
svchost.exe 1116 Services 0 61ÿ156 Ko
svchost.exe 1144 Services 0 13ÿ464 Ko
audiodg.exe 1260 Services 0 11ÿ244 Ko
svchost.exe 1288 Services 0 956 Ko
SLsvc.exe 1304 Services 0 1ÿ008 Ko
svchost.exe 1328 Services 0 4ÿ664 Ko
svchost.exe 1532 Services 0 5ÿ324 Ko
dwm.exe 1744 Console 1 348 Ko
explorer.exe 1804 Console 1 36ÿ152 Ko
spoolsv.exe 1884 Services 0 14ÿ096 Ko
taskeng.exe 1900 Console 1 3ÿ204 Ko
svchost.exe 1972 Services 0 7ÿ656 Ko
taskeng.exe 492 Services 0 996 Ko
avgwdsvc.exe 1716 Services 0 2ÿ596 Ko
svchost.exe 1812 Services 0 3ÿ364 Ko
LSSrvc.exe 1632 Services 0 84 Ko
uMgiSvr.exe 1168 Services 0 348 Ko
svchost.exe 1296 Services 0 272 Ko
svchost.exe 1440 Services 0 288 Ko
svchost.exe 1520 Services 0 2ÿ048 Ko
SeaPort.exe 1920 Services 0 924 Ko
svchost.exe 2136 Services 0 2ÿ004 Ko
avgrsx.exe 2144 Services 0 10ÿ832 Ko
avgnsx.exe 2160 Services 0 844 Ko
svchost.exe 2404 Services 0 376 Ko
WLIDSVC.EXE 2424 Services 0 1ÿ228 Ko
SearchIndexer.exe 2564 Services 0 8ÿ284 Ko
WLIDSVCM.EXE 3092 Services 0 92 Ko
MSASCui.exe 2236 Console 1 3ÿ228 Ko
RtHDVCpl.exe 2196 Console 1 628 Ko
hpwuschd2.exe 760 Console 1 436 Ko
ACDaemon.exe 2664 Console 1 60 Ko
Monitor.exe 2764 Console 1 492 Ko
jusched.exe 2900 Console 1 828 Ko
avgtray.exe 1196 Console 1 1ÿ000 Ko
hkcmd.exe 1984 Console 1 1ÿ432 Ko
igfxpers.exe 2816 Console 1 932 Ko
igfxsrvc.exe 3160 Console 1 1ÿ992 Ko
sidebar.exe 3168 Console 1 19ÿ108 Ko
ehtray.exe 3108 Console 1 1ÿ020 Ko
HPAdvisor.exe 3232 Console 1 64ÿ104 Ko
SUPERAntiSpyware.exe 3288 Console 1 896 Ko
ehmsas.exe 2540 Console 1 732 Ko
PresentationFontCache.exe 180 Services 0 696 Ko
conime.exe 3476 Console 1 1ÿ524 Ko
List_Killem.exe 4084 Console 1 6ÿ160 Ko
cmd.exe 532 Console 1 2ÿ416 Ko
WmiPrvSE.exe 1688 Services 0 11ÿ092 Ko
WmiPrvSE.exe 3484 Services 0 5ÿ144 Ko
TrustedInstaller.exe 2036 Services 0 29ÿ584 Ko
tasklist.exe 3776 Console 1 4ÿ604 Ko
======================
Cles de demarrage "Run"
======================
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun"
"ehTray.exe"="C:\\Windows\\ehome\\ehTray.exe"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\isuspm.exe -startup"
"msnmsgr"="\"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe\" /background"
"swg"="\"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\""
"HPADVISOR"="C:\\Program Files\\Hewlett-Packard\\HP Advisor\\HPAdvisor.exe view=DOCKVIEW,SYSTRAY"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,\
00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,\
73,00,20,00,44,00,65,00,66,00,65,00,6e,00,64,00,65,00,72,00,5c,00,4d,00,53,\
00,41,00,53,00,43,00,75,00,69,00,2e,00,65,00,78,00,65,00,20,00,2d,00,68,00,\
69,00,64,00,65,00,00,00
"KBD"="C:\\HP\\KBD\\KBD.EXE"
"RtHDVCpl"="RtHDVCpl.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
@=""
"NeroFilterCheck"="C:\\Windows\\system32\\NeroCheck.exe"
"ArcSoft Connection Service"="C:\\Program Files\\Common Files\\ArcSoft\\Connection Service\\Bin\\ACDaemon.exe"
"Monitor"="C:\\Windows\\PixArt\\PAC207\\Monitor.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe\""
"AVG8_TRAY"="C:\\PROGRA~1\\AVG\\AVG8\\avgtray.exe"
"Malwarebytes Anti-Malware (reboot)"="\"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe\" /runcleanupscript"
"IgfxTray"="C:\\Windows\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\Windows\\system32\\hkcmd.exe"
"Persistence"="C:\\Windows\\system32\\igfxpers.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

=====================
cles additionnelles
=====================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000001
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000
"EnableUIADesktopToggle"=dword:00000000
"UacDisableNotify"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]
@=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
@="WormRadar.com IESiteBlocker.NavFilter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
@="Search Helper"
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
@="Google Dictionary Compression sdch"
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
"NoExplorer"=dword:00000001

===============
Path : C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\hp\bin\Python;c:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Microsoft Shared\Windows Live
===============
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Windows\system32\x64"
C:\Users\Maison\LOCAL Settings\Temp\SSUPDATE.EXE
C:\Users\Maison\LOCAL Settings\Temp\wlsetup-cvr.exe

¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

"HKLM\Software\Trymedia Systems"

¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch :

9LAUNCH.EXE-4DF2A0F7.pf
ACRORD32.EXE-69A9A304.pf
AgAppLaunch.db
AgCx_S1_S-1-5-21-2791265219-2504368058-1694702237-1000.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AGENT.EXE-48781A6B.pf
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-2791265219-2504368058-1694702237-1000.db
AgGlUAD_S-1-5-21-2791265219-2504368058-1694702237-1000.db
AgRobust.db
ARCCON.AC-EB19E3B5.pf
ATBROKER.EXE-FF58B71D.pf
AVGCMGR.EXE-556E623C.pf
AVGCSRVX.EXE-82C246DD.pf
AVGNSX.EXE-D53DAA4F.pf
AVGSCANX.EXE-D27DA1F0.pf
AVGSRMAX.EXE-4B50ECB6.pf
AVGUI.EXE-97BB505D.pf
AVGUPD.EXE-2AF460D4.pf
CACLS.EXE-1F538DC1.pf
CGUARD.EXE-06C3A71A.pf
CMD.EXE-89305D47.pf
CONIME.EXE-B273009A.pf
CONSENT.EXE-65F6206D.pf
CONTROL.EXE-9459D5A0.pf
CSC.EXE-4EF173D0.pf
CVTRES.EXE-419E4E46.pf
DEFRAG.EXE-738093E8.pf
DFRGNTFS.EXE-4F838A89.pf
DLLHOST.EXE-71214090.pf
DLLHOST.EXE-7EA5E62D.pf
DLLHOST.EXE-893DDF55.pf
DLLHOST.EXE-C5C55E89.pf
DWM.EXE-AEABE78B.pf
DXSETUP.EXE-1CFD66B0.pf
EHMSAS.EXE-6BE9D904.pf
EXCEL.EXE-1D21A632.pf
EXPLORER.EXE-7A3328DA.pf
FIREWALLSETTINGS.EXE-59D9DF16.pf
FIXCFG.EXE-67406AF4.pf
FLASHUTIL10C.EXE-5DFF7861.pf
GOOGLETOOLBARNOTIFIER.EXE-B3E65CF6.pf
GOOGLETOOLBARUSER_32.EXE-6E5896AD.pf
GOOGLEUPDATERSERVICE.EXE-600E0B48.pf
GRPCONV.EXE-CAFD68AE.pf
HPQUSGL.EXE-40BE529C.pf
HPRBUPDATE.EXE-39AA089E.pf
HPWUCLI.EXE-373855A7.pf
IELOWUTIL.EXE-79D45B69.pf
IEXPLORE.EXE-1B894AFB.pf
IGFXSRVC.EXE-67E7A62F.pf
INFOCARD.EXE-0C9B4CAB.pf
JAVA.EXE-066C5985.pf
JAVAW.EXE-C4EA16F0.pf
JAVAWS.EXE-25FD1E0F.pf
LAUNCHER.EXE-9A451F51.pf
Layout.ini
LIST_KILLEM.EXE-1762B482.pf
LOGONUI.EXE-1BEE4A84.pf
MBAM.EXE-CD3441D7.pf
MCUPDATE.EXE-AF07FDE6.pf
MFPMP.EXE-73140A33.pf
MOBSYNC.EXE-D8BC6ED2.pf
MODE.COM-0F3F3F6D.pf
MPAS-D.EXE-C74E749D.pf
MPCMDRUN.EXE-BB72ED6F.pf
MPSIGSTUB.EXE-2AB17CF5.pf
MRT.EXE-C3C3D3DA.pf
MRTSTUB.EXE-741CC75F.pf
MSASCUI.EXE-6465DB72.pf
MSCORSVW.EXE-C735E247.pf
MSFEEDSSYNC.EXE-1F01ED17.pf
MSI6C12.TMP-948B70EB.pf
MSIEXEC.EXE-B5AFA339.pf
MSNMSGR.EXE-DD43BBF4.pf
MSOHTMED.EXE-972D2D6A.pf
NETSH.EXE-3DD790C5.pf
NGEN.EXE-DEAF5A03.pf
NOTEPAD.EXE-EB1B961A.pf
NTOSBOOT-B00DFAAD.pf
OFFICELIVESIGNIN.EXE-3E8ACCCB.pf
OSE.EXE-3816C9F4.pf
OUTLOOK.EXE-21C5DC4D.pf
PCAUI.EXE-8AA379C5.pf
PfSvPerfStats.bin
POQEXEC.EXE-CFF63269.pf
POWERPNT.EXE-43D2F8F0.pf
PPTVIEW.EXE-F8DF68B7.pf
PRESENTATIONFONTCACHE.EXE-42767AE9.pf
ReadyBoot
RECGUARD.EXE-B51EE930.pf
REG.EXE-26976709.pf
REMIND.EXE-058BA002.pf
REMIND_XP.DLL-30BF0B17.pf
RTHDVCPL.EXE-833BC340.pf
RUNDLL32.EXE-3D3EB3F5.pf
RUNDLL32.EXE-B9EF4314.pf
RUNDLL32.EXE-F452D79D.pf
RUNONCE.EXE-E33ED995.pf
SEARCHFILTERHOST.EXE-AA7A1FDD.pf
SEARCHINDEXER.EXE-77D27BAC.pf
SEARCHPROTOCOLHOST.EXE-AFAD3EF9.pf
SNDVOL.EXE-783DCB11.pf
SOLITAIRE.EXE-CB7A6274.pf
SPOOLSV.EXE-E4D0FF39.pf
SSUPDATE.EXE-6CA567AC.pf
SSVAGENT.EXE-B025FA52.pf
SSVAGENT.EXE-C80F109D.pf
SUPERANTISPYWARE.EXE-794980AD.pf
SUPERANTISPYWARE.EXE-BBEF79DB.pf
SVCHOST.EXE-8FD92526.pf
SYSTEMINFO.EXE-F360EB78.pf
TASKENG.EXE-5BAF290C.pf
TASKLIST.EXE-9811F41E.pf
TRUSTEDINSTALLER.EXE-031B6478.pf
USERINIT.EXE-F39AB672.pf
VERCLSID.EXE-4D95F5A7.pf
VSSVC.EXE-04D079CC.pf
WERCON.EXE-FE5CD389.pf
WERFAULT.EXE-B7E27BE5.pf
WERMGR.EXE-2A1BCBC7.pf
WINDOWS-KB890830-V3.0-DELTA.E-08C634AF.pf
WINDOWSLIVESYNC.EXE-AF90E74D.pf
WINWORD.EXE-138CEB57.pf
WLCOMM.EXE-648065CA.pf
WLIDSVC.EXE-1DBC2021.pf
WLIDSVCM.EXE-AD2DE5FA.pf
WLOOBE.EXE-532D47CA.pf
WLSETUP-CVR.EXE-E559CBDB.pf
WMIADAP.EXE-369DF1CD.pf
WMIPRVSE.EXE-43972D0F.pf
WMPLAYER.EXE-9DE758AE.pf
WUAUCLT.EXE-830BCC14.pf




¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Voilà le lien:

http://www.cijoint.fr/cjlink.php?file=cj200910/cijP9ENjcY.txt

Bonjour,

voilà les deux rapports:

Celui OTM:

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Trymedia Systems\ deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Maison
->Temp folder emptied: 155260634 bytes
File delete failed. C:\Users\Maison\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 120612772 bytes
->Java cache emptied: 29827687 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 11711865 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 302,74 mb


OTM by OldTimer - Version 3.0.0.6 log created on 10202009_133719

Files moved on Reboot...

Registry entries deleted on Reboot...



et celui de List&kill'em:


Kill'em by g3n-h@ckm@n 1.0.4.2

updated on 09.10.2009 ::::: 14.30

Windows_NT

Microsoft Windows [version 6.0.6002]


20/10/2009 13:50:23,66

Fichiers analysés :
=================


¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
"C:\Windows\system32\x64"


¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

Quarantaine :

qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
x64.Kill'em

¤¤¤¤¤¤¤¤¤¤ Verification :

Ainsi soit-il:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Maison at 2009-10-20 14:53:19
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 89 GB (60%) free of 147 GB
Total RAM: 1014 MB (28% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:53:55, on 20/10/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Users\Maison\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2ND8K6WO\RSIT[1].exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\Maison.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldfr-fr.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe

D'accord merci, je fais ca dès que possible.

et une fois que j'aurais effectué tout ca, mes probleme devrais etre rentré dans l'ordre?

Je te refais un log HitjackThis après avoir effectuétout ca?

Voilà l'analyse ToolsCleaner:

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\FindyKill.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\_OTM: trouvé !
C:\UsbFix: trouvé !
C:\FindyKill: trouvé !
C:\Rsit: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\OTM.exe: trouvé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\HijackThis.exe: trouvé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\hijackthis.log: trouvé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\Rsit.exe: trouvé !

---------------------------------
--> Suppression:

C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\OTM.exe: supprimé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\HijackThis.exe: supprimé !
C:\FindyKill.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\hijackthis.log: supprimé !
C:\Users\Maison\Desktop\Analyse anti-virus\Ne pas utiliser\Rsit.exe: supprimé !
C:\_OTM: supprimé !
C:\UsbFix: supprimé !
C:\FindyKill: supprimé !
C:\Rsit: supprimé !

Oui ca y es, tout a été effectué.

Par contre en lisant, par hasard, le tuto de HitjackThis, je me suis rendu compte que je ne l'avais pas renommé comme expliqué dans celui-ci, est-ce grave?

Le pc est toujours long a demarrer...je perd espoir...

Bonjour,

Oui j'ai fais le netyage a la lettre, je vais tout relire ce matin pour voir si je n'ai rien oublié, on sait jamais.
Par contre je n'ai pas effacé superantispyware, je le fais dès que je serais sur le poste.

J'ai bien passé Ccleaner, fais les mises a jours, la defragmentation...

Le fait de ne pas avoir renommé HitjackThis comme expliqué dans le tuto n'a pas d'importance pour son analyse et la recherche d'un eventuel virus?

Penses-tu que mon PC est encore infecté?

Bonjour,

Bon j'ai desinstallé et supprimer Superantispyware, j'ai ensuite effectué un netoyage avec CCleaner et rien ne change, le pc mets enormement de temps a demarrer.

De plus Windows bloque Malwarebytes au demarage. Les pages internet deviennent de plus en plus petite, une zone blanche se forme dans le bas de chaque pages, qui augmente au fil des changements de pages...

Je perds espoir.

Ok je fais ca demain matin.

Merci et Bonne journée.

Bonjour,

Voilà le lien pour le rapport que tu m'as demandé:

http://www.cijoint.fr/cjlink.php?file=cj200910/cijkQeTPrG.txt

Bonjour Pimprenelle,

Désolé pour mon retard, je me suis absenté un moment.

Alors j'ai fais l'analyse que tu m'a demandé et il m'est impossible de trouver ce rapport "DrWeb.csv", cela dit, l'outils n'a trouvé aucune infection.

Mon PC rame toujours au demarrage. Quel est donc mon probleme? Windows n'est il pas endommagé?

Merci.

Bonjour Pimprenelle,

Après plusieur jourd'absence, j'ai voulu faire l'analyse que tu m'a demandé, mais le lien List&Kill'em que tu m'a donné ne fonctionne pas ou n'est plus valide.
Mes problemes persistent, que dois je faire?

Merci.

Voilà le rapport:

List'em by g3n-h@ckm@n 1.1.5.2

Thx to Chiquitine29.....& CCM team

User : Maison (Administrateurs) # PC
Update on 14/12/2009 by g3n-h@ckm@n ::::: 00:00
Start at: 13:04:57 | 20/12/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18865
Windows Firewall Status : Disabled

C:\ -> Disque fixe local | 143,98 Go (87,63 Go free) [HP] | NTFS
D:\ -> Disque fixe local | 5,06 Go (601,06 Mo free) [Recovery] | NTFS
E:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe 468
C:\Windows\system32\csrss.exe 596
C:\Windows\system32\wininit.exe 640
C:\Windows\system32\csrss.exe 652
C:\Program Files\AVG\AVG9\avgchsvx.exe 664
C:\Program Files\AVG\AVG9\avgrsx.exe 672
C:\Windows\system32\services.exe 728
C:\Windows\system32\lsass.exe 740
C:\Windows\system32\lsm.exe 752
C:\Windows\system32\winlogon.exe 788
C:\Program Files\AVG\AVG9\avgcsrvx.exe 824
C:\Windows\system32\svchost.exe 1104
C:\Windows\system32\svchost.exe 1180
C:\Windows\System32\svchost.exe 1336
C:\Windows\System32\svchost.exe 1364
C:\Windows\system32\svchost.exe 1376
C:\Windows\system32\svchost.exe 1576
C:\Windows\system32\SLsvc.exe 1592
C:\Windows\system32\svchost.exe 1624
C:\Windows\system32\svchost.exe 1836
C:\Windows\System32\spoolsv.exe 604
C:\Windows\system32\svchost.exe 972
C:\Windows\system32\taskeng.exe 1064
C:\Windows\system32\Dwm.exe 1288
C:\Windows\Explorer.EXE 1428
C:\Windows\system32\taskeng.exe 1460
C:\Program Files\AVG\AVG9\avgwdsvc.exe 2204
C:\Windows\system32\svchost.exe 2400
c:\Program Files\Common Files\LightScribe\LSSrvc.exe 2420
C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe 2480
C:\Windows\system32\svchost.exe 2564
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2580
C:\Windows\system32\svchost.exe 2660
C:\Windows\System32\svchost.exe 2736
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 2760
C:\Windows\system32\SearchIndexer.exe 2880
C:\Program Files\AVG\AVG9\avgnsx.exe 3008
C:\Windows\system32\WUDFHost.exe 3472
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe 3680
C:\Windows\RtHDVCpl.exe 1264
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe 3204
C:\Windows\PixArt\Pac207\Monitor.exe 968
C:\Windows\System32\hkcmd.exe 944
C:\Windows\System32\igfxpers.exe 2820
C:\Program Files\Java\jre6\bin\jusched.exe 3072
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe 1204
C:\Program Files\AVG\AVG9\avgtray.exe 3040
C:\Program Files\Windows Sidebar\sidebar.exe 3868
C:\Windows\ehome\ehtray.exe 3872
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe 3708
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 3468
C:\Windows\system32\igfxsrvc.exe 3968
C:\Windows\ehome\ehmsas.exe 3972
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe 1168
C:\Windows\system32\conime.exe 2076
C:\Windows\system32\wuauclt.exe 5636
C:\Users\Maison\AppData\Local\Temp\Temp1_List_Killem.zip\List_Kill'em.exe 2384
C:\Windows\system32\cmd.exe 5012
C:\Windows\system32\SearchProtocolHost.exe 2372
C:\Windows\system32\SearchFilterHost.exe 5948
C:\Windows\system32\wbem\wmiprvse.exe 5800
C:\Users\Maison\AppData\Local\Temp\7AED.tmp\pv.exe 4680

======================
Keys "Run"
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
ISUSPM Startup REG_SZ C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HPADVISOR REG_SZ C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
RtHDVCpl REG_SZ RtHDVCpl.exe
<NO NAME> REG_SZ
ArcSoft Connection Service REG_SZ C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Monitor REG_SZ C:\Windows\PixArt\PAC207\Monitor.exe
Malwarebytes Anti-Malware (reboot) REG_SZ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
IgfxTray REG_SZ C:\Windows\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\Windows\system32\hkcmd.exe
Persistence REG_SZ C:\Windows\system32\igfxpers.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
Google Quick Search Box REG_SZ "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM REG_SZ "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
AVG9_TRAY REG_SZ C:\PROGRA~1\AVG\AVG9\avgtray.exe

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
Launcher REG_EXPAND_SZ %WINDIR%\SMINST\launcher.exe

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
ConsentPromptBehaviorAdmin REG_DWORD 2 (0x2)
ConsentPromptBehaviorUser REG_DWORD 1 (0x1)
EnableInstallerDetection REG_DWORD 1 (0x1)
EnableLUA REG_DWORD 1 (0x1)
EnableSecureUIAPaths REG_DWORD 1 (0x1)
EnableVirtualization REG_DWORD 1 (0x1)
PromptOnSecureDesktop REG_DWORD 1 (0x1)
ValidateAdminCodeSignatures REG_DWORD 0 (0x0)
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
scforceoption REG_DWORD 0 (0x0)
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)
FilterAdministratorToken REG_DWORD 0 (0x0)
EnableUIADesktopToggle REG_DWORD 0 (0x0)
UacDisableNotify REG_DWORD 0 (0x0)

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
NoDriveAutoRun REG_BINARY ffffffff
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage REG_DWORD 0 (0x0)
NoDriveAutoRun REG_BINARY ffffffff
NoDriveTypeAutoRun REG_DWORD 255 (0xff)
HonorAutoRunSetting REG_DWORD 1 (0x1)

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS REG_SZ avgrsstx.dll

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

===============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

Ndisuio : 0x3
EapHost : 0x2
Wlansvc : 0x2
SharedAccess : 0x2
windefend : 0x2
wuauserv : 0x2
wscsvc : 0x2

=========

=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: HP

Taille du volume = 144 Go
Espace libre = 87.64 Go
tendue d'espace libre la plus grande = 25.01 Go
Pourcentage de fragmentation des fichiers = 1 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n‚cessaire de d‚fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Files/folders :

C:\ProgramData\Desktop
C:\ProgramData\Documents
C:\ProgramData\Trymedia
C:\Users\Maison\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv.exe

¤¤¤¤¤¤¤¤¤¤ Keys :

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "DisableRegistryTools"
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr"
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d}
HKLM\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}

================
Other infections
================

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-20 13:09:29
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

==========
Programs
==========

Adobe
Ahead
Alwil Software
ArcSoft
AVG
CCleaner
Common Files
desktop.ini
directx
DivX
EA GAMES
eMule
Fichiers communs
Gamenext
GameSpy Arcade
Google
Hewlett-Packard
HP
InstallShield Installation Information
Intel
Internet Explorer
Java
Malwarebytes' Anti-Malware
Megaware
Micro Application
Microprose
Microsoft
Microsoft CAPICOM 2.1.0.2
Microsoft Games
Microsoft Office
Microsoft Office Outlook Connector
Microsoft Silverlight
Microsoft SQL Server Compact Edition
Microsoft Sync Framework
Microsoft Works
Microsoft.NET
Movie Maker
MSBuild
MSXML 4.0
Nero
Neuf
Oberon Media
PC-Doctor 5 for Windows
Realtek
Reference Assemblies
Roxio
Services en ligne
Spybot - Search & Destroy
Sun
SUPERAntiSpyware
trend micro
Uninstall Information
Virtools
Webcam 1200
Windows Calendar
Windows Collaboration
Windows Defender
Windows Journal
Windows Live
Windows Live SkyDrive
Windows Mail
Windows Media Player
Windows NT
Windows Photo Gallery
Windows Portable Devices
Windows Sidebar
Yahoo!

============
Lecteur C:
============

$AVG
$Recycle.Bin
ANUMAN INTERACTIVE
autoexec.bat
autorun.inf
Boonty
Boot
bootmgr
BOOTSECT.BAK
Config.Msi
config.sys
Documents and Settings
hp
Intel
IO.SYS
Kill'em
List'em.txt
MSDOS.SYS
MSOCache
pagefile.sys
PerfLogs
Program Files
ProgramData
System Volume Information
Users
Windows

¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials





¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Voilà le rapport:

Kill'em by g3n-h@ckm@n 1.1.5.2

User : Maison () # PC
Update on 14/12/2009 by g3n-h@ckm@n ::::: 00:00
Start at: 13:09:23 | 07/01/2010
Contact : g3n-h@ckm@n sur CCM

Intel(R) Pentium(R) 4 CPU 3.00GHz
Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18865
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 143,98 Go (86,05 Go free) [HP] | NTFS
D:\ -> Disque fixe local | 5,06 Go (701,06 Mo free) [Recovery] | NTFS
E:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe 284
C:\Windows\system32\csrss.exe 344
C:\Windows\system32\csrss.exe 380
C:\Windows\system32\wininit.exe 388
C:\Windows\system32\winlogon.exe 432
C:\Windows\system32\services.exe 464
C:\Windows\system32\lsass.exe 476
C:\Windows\system32\lsm.exe 484
C:\Windows\system32\svchost.exe 624
C:\Windows\system32\svchost.exe 680
C:\Windows\System32\svchost.exe 812
C:\Windows\system32\svchost.exe 836
C:\Windows\system32\svchost.exe 904
C:\Windows\Explorer.EXE 1060
C:\Users\Maison\AppData\Local\Temp\Temp2_List_Killem.zip\List_Kill'em.exe 1396
C:\Windows\system32\cmd.exe 1420
C:\Windows\system32\wbem\wmiprvse.exe 1596
C:\Users\Maison\AppData\Local\Temp\6B6E.tmp\pv.exe 1780

Detections :
==========


¤¤¤¤¤¤¤¤¤¤ Files/folders :

"C:\ProgramData\Desktop"
"C:\ProgramData\Documents"
"C:\ProgramData\Trymedia"
C:\Users\Maison\LOCAL Settings\Temp\jre-6u17-windows-i586-iftw-rv.exe


¤¤¤¤¤¤¤¤¤¤ Files/folders deleted :

Quarantine :

jre-6u17-windows-i586-iftw-rv.exe.Kill'em
Trymedia.Kill'em

==============
host file OK !
==============

========
Registry
========
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d}

============
Disk Cleaned
============

================
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Bonjour,

A tu vu le rapport que j'ai posté?

Voilà le RSIT:


Fichier log.txt


Logfile of random's system information tool 1.06 (written by random/random)
Run by Maison at 2010-01-21 13:29:01
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 90 GB (61%) free of 147 GB
Total RAM: 1014 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:29:53, on 21/01/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Maison\Desktop\RSIT.exe
C:\Program Files\trend micro\Maison.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fdajo%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldfr-fr.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Service Google Update (gupdate1ca564e21710743) (gupdate1ca564e21710743) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe